HackingEducationEducationTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

Nebraska State College System

bd_f372ea90e76a2346 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 23, 2012

Filed

Aug 15, 2012

To disclose

12 weeks

Affected

33state residents only

Linked

2 filings

Confidence

66%

Full breach record for Nebraska State College System →

Nebraska State College System (NSCS) notified the NH Attorney General of a data breach affecting 33 NH residents. Unauthorized access occurred on May 23, 2012, compromising names, SSNs, addresses, and financial aid data. NSCS retained legal counsel and forensic experts (Kroll) and notified credit bureaus and law enforcement. Investigation was ongoing as of August 15, 2012.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 84 days

May 23, 2012

Begins

May 23, 2012

Discovered

Aug 15, 2012

Filed

vs. sector median

+3 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_e005849477ec5cc62012-09-10 · +26dVerified

Name: Nebraska State College System
norm: nebraska state college system
Domain: nscs.edu

Name: Nebraska State College System
norm: nebraska state college system
Domain: nscs.edu
Industry: Educationllm

Discovered: May 23, 2012
Breach occurred: May 23, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2012
Affected individuals: 33state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney GeneralProviding notice to other state regulatorsLocal and federal law enforcement investigations are ongoing
Initial access: exploit_public_facing

During the incident: Retained Nelson, Levine, de Luca & Hamilton, LLC, breach notification legal counsel
Retained forensic computer analysts Kroll Information Assurance, Inc.
Notified the three major credit reporting agencies
Notified state regulators
Intends to notify various regulators in foreign countries
Engaged Kroll Advisory Solutions to provide expertise, information and support services
Established a call center dedicated to this matter
Changes made: Took immediate corrective action to stop and prevent further unauthorized access
Police seized computers and related equipment belonging to a University of Nebraska-Lincoln (UNL) undergraduate student
Intends to take thorough steps to improve the security of our systems
Created a dedicated website providing information related to the matter
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGAug 15 · first · this page

California State AG+26d

Pattern: first filing Aug 15 (NH), last Sep 10 (CA) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nebraska-state-20120815.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 15, 2012
Raw hash: a6516fd497a9064d68a0c1b8e08058b621b418d50534184c593188d3b9ba8b1e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNebraska State College System

Victim entityNebraska State College System

Incidentdiscovered May 23, 2012

Stated responseRetained Nelson, Levine, de Luca & Hamilton, LLC, breach notification legal counsel

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov